2019-03-21 15:46:04

by Fabien DESSENNE

Subject: [PATCH] tty: fix NULL pointer issue when tty_port ops is not set

Unlike 'client_ops' which is initialized to 'default_client_ops', the
port operations 'ops' may be left to NULL.
Check the 'ops' value before checking the 'ops->x' value.

Signed-off-by: Fabien Dessenne <[email protected]>
---
drivers/tty/tty_port.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
index 044c3cb..a9e12b3 100644
--- a/drivers/tty/tty_port.c
+++ b/drivers/tty/tty_port.c
@@ -325,7 +325,7 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty)
if (tty && C_HUPCL(tty))
tty_port_lower_dtr_rts(port);

- if (port->ops->shutdown)
+ if (port->ops && port->ops->shutdown)
port->ops->shutdown(port);
}
out:
@@ -398,7 +398,7 @@ EXPORT_SYMBOL_GPL(tty_port_tty_wakeup);
*/
int tty_port_carrier_raised(struct tty_port *port)
{
- if (port->ops->carrier_raised == NULL)
+ if (!port->ops || !port->ops->carrier_raised)
return 1;
return port->ops->carrier_raised(port);
}
@@ -414,7 +414,7 @@ EXPORT_SYMBOL(tty_port_carrier_raised);
*/
void tty_port_raise_dtr_rts(struct tty_port *port)
{
- if (port->ops->dtr_rts)
+ if (port->ops && port->ops->dtr_rts)
port->ops->dtr_rts(port, 1);
}
EXPORT_SYMBOL(tty_port_raise_dtr_rts);
@@ -429,7 +429,7 @@ EXPORT_SYMBOL(tty_port_raise_dtr_rts);
*/
void tty_port_lower_dtr_rts(struct tty_port *port)
{
- if (port->ops->dtr_rts)
+ if (port->ops && port->ops->dtr_rts)
port->ops->dtr_rts(port, 0);
}
EXPORT_SYMBOL(tty_port_lower_dtr_rts);
@@ -684,7 +684,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,

if (!tty_port_initialized(port)) {
clear_bit(TTY_IO_ERROR, &tty->flags);
- if (port->ops->activate) {
+ if (port->ops && port->ops->activate) {
int retval = port->ops->activate(port, tty);
if (retval) {
mutex_unlock(&port->mutex);
--
2.7.4

2019-03-21 17:40:01

by Greg Kroah-Hartman

Subject: Re: [PATCH] tty: fix NULL pointer issue when tty_port ops is not set

On Thu, Mar 21, 2019 at 04:43:26PM +0100, Fabien Dessenne wrote:
> Unlike 'client_ops' which is initialized to 'default_client_ops', the
> port operations 'ops' may be left to NULL.
> Check the 'ops' value before checking the 'ops->x' value.
>
> Signed-off-by: Fabien Dessenne <[email protected]>
> ---
> drivers/tty/tty_port.c | 10 +++++-----
> 1 file changed, 5 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
> index 044c3cb..a9e12b3 100644
> --- a/drivers/tty/tty_port.c
> +++ b/drivers/tty/tty_port.c
> @@ -325,7 +325,7 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty)
> if (tty && C_HUPCL(tty))
> tty_port_lower_dtr_rts(port);
>
> - if (port->ops->shutdown)
> + if (port->ops && port->ops->shutdown)
> port->ops->shutdown(port);
> }
> out:
> @@ -398,7 +398,7 @@ EXPORT_SYMBOL_GPL(tty_port_tty_wakeup);
> */
> int tty_port_carrier_raised(struct tty_port *port)
> {
> - if (port->ops->carrier_raised == NULL)
> + if (!port->ops || !port->ops->carrier_raised)
> return 1;
> return port->ops->carrier_raised(port);
> }
> @@ -414,7 +414,7 @@ EXPORT_SYMBOL(tty_port_carrier_raised);
> */
> void tty_port_raise_dtr_rts(struct tty_port *port)
> {
> - if (port->ops->dtr_rts)
> + if (port->ops && port->ops->dtr_rts)
> port->ops->dtr_rts(port, 1);
> }
> EXPORT_SYMBOL(tty_port_raise_dtr_rts);
> @@ -429,7 +429,7 @@ EXPORT_SYMBOL(tty_port_raise_dtr_rts);
> */
> void tty_port_lower_dtr_rts(struct tty_port *port)
> {
> - if (port->ops->dtr_rts)
> + if (port->ops && port->ops->dtr_rts)
> port->ops->dtr_rts(port, 0);
> }
> EXPORT_SYMBOL(tty_port_lower_dtr_rts);
> @@ -684,7 +684,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
>
> if (!tty_port_initialized(port)) {
> clear_bit(TTY_IO_ERROR, &tty->flags);
> - if (port->ops->activate) {
> + if (port->ops && port->ops->activate) {
> int retval = port->ops->activate(port, tty);
> if (retval) {
> mutex_unlock(&port->mutex);
> --
> 2.7.4
>

Can you hit this today with any in-kernel drivers? Or is this only for
your new code you are adding?

thanks,

greg k-h

2019-03-22 08:37:06

by Fabien DESSENNE

Subject: Re: [PATCH] tty: fix NULL pointer issue when tty_port ops is not set

Hi Greg,

I do not think that any driver faces this problem.

Nevertheless I found 2 drivers declaring an 'empty' struct (wasted) to
solve this issue:

drivers/char/ttyprintk:
static const struct tty_port_operations null_ops = { };

drivers/tty/vcc.c:
static struct tty_port_operations vcc_port_ops = { 0 };


Please let me know if you prefer I abandon this patch and use an 'empty'
struct in the new code I add.

Or if you think that this patch is safe, feel free to ask me to update
the two drivers listed above.


BR


Fabien



On 21/03/2019 6:38 PM, Greg Kroah-Hartman wrote:
> On Thu, Mar 21, 2019 at 04:43:26PM +0100, Fabien Dessenne wrote:
>> Unlike 'client_ops' which is initialized to 'default_client_ops', the
>> port operations 'ops' may be left to NULL.
>> Check the 'ops' value before checking the 'ops->x' value.
>>
>> Signed-off-by: Fabien Dessenne <[email protected]>
>> ---
>> drivers/tty/tty_port.c | 10 +++++-----
>> 1 file changed, 5 insertions(+), 5 deletions(-)
>>
>> diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
>> index 044c3cb..a9e12b3 100644
>> --- a/drivers/tty/tty_port.c
>> +++ b/drivers/tty/tty_port.c
>> @@ -325,7 +325,7 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty)
>> if (tty && C_HUPCL(tty))
>> tty_port_lower_dtr_rts(port);
>>
>> - if (port->ops->shutdown)
>> + if (port->ops && port->ops->shutdown)
>> port->ops->shutdown(port);
>> }
>> out:
>> @@ -398,7 +398,7 @@ EXPORT_SYMBOL_GPL(tty_port_tty_wakeup);
>> */
>> int tty_port_carrier_raised(struct tty_port *port)
>> {
>> - if (port->ops->carrier_raised == NULL)
>> + if (!port->ops || !port->ops->carrier_raised)
>> return 1;
>> return port->ops->carrier_raised(port);
>> }
>> @@ -414,7 +414,7 @@ EXPORT_SYMBOL(tty_port_carrier_raised);
>> */
>> void tty_port_raise_dtr_rts(struct tty_port *port)
>> {
>> - if (port->ops->dtr_rts)
>> + if (port->ops && port->ops->dtr_rts)
>> port->ops->dtr_rts(port, 1);
>> }
>> EXPORT_SYMBOL(tty_port_raise_dtr_rts);
>> @@ -429,7 +429,7 @@ EXPORT_SYMBOL(tty_port_raise_dtr_rts);
>> */
>> void tty_port_lower_dtr_rts(struct tty_port *port)
>> {
>> - if (port->ops->dtr_rts)
>> + if (port->ops && port->ops->dtr_rts)
>> port->ops->dtr_rts(port, 0);
>> }
>> EXPORT_SYMBOL(tty_port_lower_dtr_rts);
>> @@ -684,7 +684,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty,
>>
>> if (!tty_port_initialized(port)) {
>> clear_bit(TTY_IO_ERROR, &tty->flags);
>> - if (port->ops->activate) {
>> + if (port->ops && port->ops->activate) {
>> int retval = port->ops->activate(port, tty);
>> if (retval) {
>> mutex_unlock(&port->mutex);
>> --
>> 2.7.4
>>
> Can you hit this today with any in-kernel drivers? Or is this only for
> your new code you are adding?
>
> thanks,
>
> greg k-h